We've moved! Come visit our new blog:

Blog Archive

Tuesday, July 28, 2009

Google Apps + OpenID = identity hub for SaaS

We're happy to announce that theGoogle OpenID Federated Login APIhas been extended toGoogle Appsaccounts used by businesses, schools, and other organizations. Individuals in these organizations can now sign in to third party websites using their Google Apps account, without sharing their credentials with third parties.

In addition, Google Apps can now become an identity hub for multiple SaaS providers, simplifying identity management for organizations. For example, when integrated with partner solutions such as PingConnect fromPing Identity, the Google Open ID Federated Login API enables a single Google Apps login to help provide secure access to services like Salesforce.com, SuccessFactors, and WebEX — as well as B2B partners, internal applications, and of course consumer web sites. SeePing Identity's postto learn more about their implementation and view thedemo.

Another early adopter isManymoon.com, a SaaS project management vendor that implemented the Google Open ID Federated Login API directly to make it easier for any organization using Google Apps to sign up for and deploy Manymoon to their users:

In the Manymoon Login page, the user chooses to log in using a Google Apps account

The user types in his Google Apps email address. The user never gives away his Google Apps Account password to Manymoon.

The user is redirected to the Google Apps domain to approve sharing information with Manymoon.

Once approved, the user is redirected to Manymoon and is signed in and ready to work with selected accounts.

If you prefer an out-of-the-box solution, we have been working withJanRain, a provider of OpenID solutions that already supports the new API as part of their RPX product.

Supporting the API for Google Apps accounts is exciting news for theOpenID community, as it adds numerous new Identity Provider (IDP) domains and increases the OpenID end user base by millions. In order to allow websites to easily become Relying Parties for these many new IDPs and users, we defined a newdiscovery protocol. The protocol is designed to allow Relying Parties to identify that a given domain is hosted on Google Apps and to help provide secure access its OpenID Provider End Point. The current proposal is an interim solution, and we are participating in several standardization organizations, such asOASIS and theOpenID Foundation, to generate a next-generation standard. Since the current protocol proposal is not supported by the standard OpenID libraries, we provided an implementation of the Relying Party pieces at the Open Source project,step2.googlecode.com. Google is also offering a set of resources addressing the issues of designing a scalable Federated Login User Interface. You are welcome to visit theUser Experience summary for Federated LoginGoogle Sites page, where you can find links to demos, mocks, and usability research data.

You can find more details in our API and Discovery documentation, or join the discussions in theGoogle Federated Login API Group, where you can ask any question and get answers from other Identity Providers, Relying Parties and Google engineers.

The OpenID Federated Login Service is available for all Google Apps editions. However, it is disabled by default for the Premier and Education editions, and it requires the domain administrator to manually enable it from the Control Panel. We've enabled the service for our employees here at Google, and domain administrators — you can alsoenable it for your domain.

Next up, can we see Google (Apps) accounts become a relying party, i.e. accept OpenID credentials from other OpenID providers? That would obviously be opt-in also but would encourage more widespread OpenID adoption.

Here is what is missing: augment the google account login process with an (optional, if you want) required one-time password using the RFC 4223 (OATH) standard.

Why? Because if I'm going to leverage my google account login to login to a bunch of other web sites, then it's important to me to apply an extra layer of security that you get with two-factor authentication.

There are software versions of OATH tokens for smart phones like the iPhone, so no hardware token would be required.

You can get OATH and various other types of strong authentication (via SAML IdP to Google Apps) from 3rd party service providers. The www.myonelogin.com solution offers many multi-factor authentication options. A full list of MFA solutions can be found at the Google Marketplace:

To view and manage the list of websites you granted access, simply go to: www.google.com/a/example.com/ManageAccount (replacing "example.com" with your domain) and click on the "Change authorized websites" link

Anything announced for individual Google accounts vs. a Google App account? Would love to see this feature extended/offered to individuals, allowing them to centrally manage their SaaS application credentials.

Socialwok also supports OpenID integration with Google Apps and Google accounts. See how Socialwok for Google Apps provides Google Apps users a feed based group collaboration tool. http://youtube.com/socialwok

I posted a tutorial on how to use your domain name as your OpenID URI with Google Apps since I couldn't find it in Google's documentation: http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/

When will Google let me use another OpenID provider (i.e., when will Google be a relying party)?

There are much better providers out there than Google, which is plain old usernames and passwords. Personally, I use VeriSign PIP, which has two factor authentication using a wallet sized card that PayPal sells for $5.